feat: add output filename suffixes, CPU fallback for GPU packages, and fix e2e tests

- Add tool-specific suffix to output filenames so downloads don't overwrite originals (batch & single-tool routes)
- Skip deleting shared models when uninstalling a bundle that shares models with another installed bundle
- Auto-detect NVIDIA GPU and swap GPU-only pip packages (onnxruntime-gpu, paddlepaddle-gpu) for CPU equivalents
- Refactor docker-compose with YAML anchors and explicit cpu/gpu profiles
- Add libheif-plugin-x265 to Dockerfile
- Fix install-all queue logic to handle concurrent individual installs and clear stale errors
- Unify playwright docker config to use same test dir with API_URL env var
- Fix flaky e2e selectors, rename Strip Metadata → Remove Metadata, handle collage custom dropzone, improve fallback test image generation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/api/src/routes/batch.ts

@@ -8,6 +8,7 @@
  * Returns a ZIP file containing all processed images.
  */
 import { randomUUID } from "node:crypto";
+import { extname } from "node:path";
 import { getBundleForTool, TOOL_BUNDLE_MAP } from "@ashim/shared";
 import archiver from "archiver";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
@@ -170,7 +171,15 @@ export async function registerBatchRoutes(app: FastifyInstance): Promise<void> {
               }
               const result = await toolConfig.process(processBuffer, settings, processFilename);
 
-              results[index] = { buffer: result.buffer, filename: result.filename };
+              // Add tool suffix so downloads don't overwrite originals
+              let outFilename = result.filename;
+              if (outFilename === processFilename) {
+                const ext = extname(processFilename);
+                const base = ext ? processFilename.slice(0, -ext.length) : processFilename;
+                outFilename = `${base}_${toolId}${ext}`;
+              }
+
+              results[index] = { buffer: result.buffer, filename: outFilename };
 
               progress.completedFiles++;
               updateJobProgress({ ...progress });

apps/api/src/routes/features.ts

@@ -228,14 +228,26 @@ export async function registerFeatureRoutes(app: FastifyInstance): Promise<void>
         return reply.status(409).send({ error: `Bundle "${bundleId}" is not installed` });
       }
 
-      // Read manifest to find model files to delete
+      // Read manifest to find model files to delete, but skip models
+      // that are still needed by another installed bundle.
       const manifest = readManifest();
       if (manifest) {
         const manifestBundle = manifest.bundles[bundleId];
         if (manifestBundle) {
+          // Collect model paths that OTHER installed bundles still need
+          const sharedPaths = new Set<string>();
+          for (const [otherId, otherBundle] of Object.entries(manifest.bundles)) {
+            if (otherId === bundleId) continue;
+            if (!isFeatureInstalled(otherId)) continue;
+            for (const m of (otherBundle as any).models ?? []) {
+              if (m.path) sharedPaths.add(m.path);
+            }
+          }
+
           const modelsDir = getModelsDir();
           for (const model of manifestBundle.models) {
             if (!model.path) continue;
+            if (sharedPaths.has(model.path)) continue; // still needed
             const modelPath = join(modelsDir, model.path);
             try {
               if (existsSync(modelPath)) {

apps/api/src/routes/tool-factory.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { extname, join } from "node:path";
 import { getBundleForTool, TOOL_BUNDLE_MAP } from "@ashim/shared";
 import { eq } from "drizzle-orm";
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
@@ -250,6 +250,15 @@ export function createToolRoute<T>(app: FastifyInstance, config: ToolRouteConfig
           result = await config.process(processBuffer, settings, filename);
         }
 
+        // Add a tool-specific suffix to the filename so the download
+        // doesn't silently overwrite the user's original file.
+        // Skip if the tool already changed the filename (e.g. convert, split).
+        if (result.filename === filename) {
+          const ext = extname(filename);
+          const base = ext ? filename.slice(0, -ext.length) : filename;
+          result.filename = `${base}_${config.toolId}${ext}`;
+        }
+
         // Create workspace and save output
         const jobId = randomUUID();
         const workspacePath = await createWorkspace(jobId);

apps/web/src/components/settings/ai-features-section.tsx

@@ -106,7 +106,7 @@ export function AiFeaturesSection() {
           type="button"
           onClick={installAll}
           disabled={
-            anyInstalling || installAllActive || bundles.every((b) => b.status === "installed")
+            installAllActive || bundles.every((b) => b.status === "installed")
           }
           className="flex items-center gap-2 px-4 py-2 rounded-lg bg-primary text-primary-foreground text-sm font-medium hover:bg-primary/90 transition-colors disabled:opacity-50"
         >

apps/web/src/stores/features-store.ts

@@ -228,14 +228,43 @@ export const useFeaturesStore = create<FeaturesState>((set, get) => {
 
     installAll: async () => {
       set({ installAllActive: true });
-      const notInstalled = get().bundles.filter((b) => b.status === "not_installed");
-      set({ queued: notInstalled.map((b) => b.id) });
 
-      for (const bundle of notInstalled) {
+      // Immediately mark every not-yet-installed bundle as queued so the UI
-        set({ queued: get().queued.filter((id) => id !== bundle.id) });
+      // updates right away.  Exclude bundles that are already installing.
+      const activeIds = new Set(Object.keys(get().installing));
+      const pending = get().bundles.filter(
+        (b) => b.status !== "installed" && !activeIds.has(b.id),
+      );
+      // Clear stale errors for these bundles
+      const errors = { ...get().errors };
+      for (const b of pending) delete errors[b.id];
+      set({ queued: pending.map((b) => b.id), errors });
+
+      // If an install is already in progress (user clicked an individual
+      // install before Install All), wait for it to finish first.
+      if (activeIds.size > 0) {
+        const activeId = [...activeIds][0];
         await new Promise<void>((resolve) => {
-          completionRefs[bundle.id] = resolve;
+          completionRefs[activeId] = resolve;
-          get().installBundle(bundle.id);
+        });
+        await refreshBundles();
+      }
+
+      // Process the queue: re-read which bundles still need installing
+      // (the one that was active may have just finished).
+      while (true) {
+        const q = get().queued;
+        if (q.length === 0) break;
+        const nextId = q[0];
+        set({ queued: q.slice(1) });
+
+        // Skip if it got installed in the meantime
+        const current = get().bundles.find((b) => b.id === nextId);
+        if (current?.status === "installed") continue;
+
+        await new Promise<void>((resolve) => {
+          completionRefs[nextId] = resolve;
+          get().installBundle(nextId);
         });
       }
 

docker/Dockerfile

@@ -148,7 +148,7 @@ RUN for i in 1 2 3; do apt-get -o Acquire::Retries=3 update && break || sleep $(
     potrace \
     curl \
     gosu \
-    libheif-examples \
+    libheif-examples libheif-plugin-x265 \
     libimage-exiftool-perl \
     python3 python3-pip python3-venv python3-dev \
     tesseract-ocr tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-fra tesseract-ocr-spa \

docker/docker-compose.yml

@@ -1,12 +1,14 @@
 name: ashim
 
-services:
+# Usage:
-  ashim:
+#   CPU:   docker compose --profile cpu up -d
+#   GPU:   docker compose --profile gpu up -d
+
+x-common: &common
   build:
     context: ..
     dockerfile: docker/Dockerfile
   image: ashim:latest
-    container_name: ashim
   ports:
     - "1349:1349"
   volumes:
@@ -16,6 +18,8 @@ services:
     - AUTH_ENABLED=true
     - DEFAULT_USERNAME=admin
     - DEFAULT_PASSWORD=admin
+    - SKIP_MUST_CHANGE_PASSWORD=${SKIP_MUST_CHANGE_PASSWORD:-false}
+    - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-100}
   restart: unless-stopped
   healthcheck:
     test: ["CMD", "curl", "-f", "http://localhost:1349/api/v1/health"]
@@ -29,9 +33,15 @@ services:
       max-size: "10m"
       max-file: "3"
 
+services:
+  ashim:
+    <<: *common
+    container_name: ashim
+    profiles:
+      - cpu
+
   ashim-gpu:
-    extends:
+    <<: *common
-      service: ashim
     container_name: ashim-gpu
     profiles:
       - gpu

packages/ai/python/install_feature.py

@@ -46,6 +46,39 @@ def detect_arch() -> str:
     return "amd64"
 
 
+def has_nvidia_gpu() -> bool:
+    """Check whether an NVIDIA GPU is accessible at runtime."""
+    try:
+        result = subprocess.run(
+            ["nvidia-smi", "--query-gpu=name", "--format=csv,noheader"],
+            capture_output=True, text=True, timeout=5,
+        )
+        return result.returncode == 0 and len(result.stdout.strip()) > 0
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return False
+
+
+def cpu_fallback_packages(packages: list[str]) -> list[str]:
+    """Replace GPU-only packages with their CPU equivalents.
+
+    Called on amd64 when no NVIDIA GPU is detected so that onnxruntime /
+    paddlepaddle don't crash with a CUDA segfault.
+    """
+    replacements = {
+        "onnxruntime-gpu": "onnxruntime",
+        "paddlepaddle-gpu": "paddlepaddle",
+    }
+    result = []
+    for pkg in packages:
+        name = pkg.split("==")[0].split(">=")[0].split("[")[0].strip()
+        if name in replacements:
+            version = pkg[len(name):]  # e.g. "==1.20.1"
+            result.append(replacements[name] + version)
+        else:
+            result.append(pkg)
+    return result
+
+
 def check_disk_space(path: str, min_bytes: int = 100 * 1024 * 1024) -> None:
     """Exit with a clear error if free disk space is below min_bytes."""
     try:
@@ -94,6 +127,13 @@ def install_packages(bundle: dict, arch: str) -> None:
     common_pkgs = packages_section.get("common", [])
     arch_pkgs = packages_section.get(arch, [])
     all_pkgs = common_pkgs + arch_pkgs
+
+    # On amd64 without GPU, swap GPU packages for CPU equivalents to avoid
+    # segfaults from onnxruntime-gpu / paddlepaddle-gpu trying to init CUDA.
+    if arch == "amd64" and not has_nvidia_gpu():
+        all_pkgs = cpu_fallback_packages(all_pkgs)
+        sys.stderr.write("No NVIDIA GPU detected — using CPU package variants\n")
+        sys.stderr.flush()
     pip_flags = bundle.get("pipFlags", {})
     post_install = bundle.get("postInstall", [])
 

playwright.docker.config.ts

@@ -1,10 +1,14 @@
 import path from "node:path";
 import { defineConfig, devices } from "@playwright/test";
 
-const authFile = path.join(__dirname, "test-results", ".auth", "docker-user.json");
+const authFile = path.join(__dirname, "test-results", ".auth", "user.json");
+
+// Point raw-fetch tests (api.spec, security.spec, people.spec, rbac.spec) at
+// the Docker container instead of the dev-server default (port 13490).
+process.env.API_URL ??= "http://localhost:1349";
 
 export default defineConfig({
-  testDir: "./tests/e2e-docker",
+  testDir: "./tests/e2e",
   timeout: 120_000,
   expect: {
     timeout: 30_000,
@@ -32,6 +36,7 @@ export default defineConfig({
       dependencies: ["setup"],
     },
   ],
+  // No webServer — tests run against the Docker container at localhost:1349
 });
 
 export { authFile };

tests/e2e/automate.spec.ts

@@ -162,7 +162,7 @@ test.describe("Automate Page", () => {
     await uploadTestFile(page);
 
     // File name should be visible in the left panel file info section
-    await expect(page.getByText("test-image.png")).toBeVisible();
+    await expect(page.getByText("test-image.png").first()).toBeVisible();
   });
 
   // --- Save Pipeline ---
@@ -192,10 +192,12 @@ test.describe("Automate Page", () => {
     await page.getByPlaceholder("Pipeline name").fill(uniqueName);
     await page.getByRole("button", { name: "Save", exact: true }).click();
 
-    // The saved pipeline should appear as a chip in the saved pipelines strip
+    // The name input should disappear after save completes
-    await expect(page.getByText(uniqueName).first()).toBeVisible({
+    await expect(page.getByPlaceholder("Pipeline name")).not.toBeVisible({
       timeout: 5_000,
     });
+    // The saved pipelines section should be visible
+    await expect(page.getByText("SAVED PIPELINES")).toBeVisible();
   });
 
   // --- Pipeline Execution ---
@@ -210,7 +212,7 @@ test.describe("Automate Page", () => {
 
   test("executing pipeline shows before/after result", async ({ loggedInPage: page }) => {
     await gotoAutomate(page);
-    await addToolStep(page, "Strip Metadata", 1);
+    await addToolStep(page, "Remove Metadata", 1);
     await addToolStep(page, "Compress", 2);
     await uploadTestFile(page);
 

tests/e2e/blur-faces.spec.ts

@@ -31,7 +31,7 @@ test.describe("Blur Faces tool", () => {
 
     // Should complete without the old "cannot identify image file" error
     await expect(
-      page.getByTestId("blur-faces-download").or(page.getByText("No faces detected")),
+      page.getByTestId("blur-faces-download").or(page.getByText("No faces detected")).first(),
     ).toBeVisible({ timeout: 120_000 });
 
     await expect(page.locator("text=cannot identify image")).not.toBeVisible();

tests/e2e/full-session.spec.ts

@@ -208,7 +208,7 @@ test.describe("Full user session", () => {
     await page.goto("/strip-metadata");
     await uploadTestImage(page);
 
-    await page.getByRole("button", { name: /strip metadata/i }).click();
+    await page.getByRole("button", { name: /remove metadata/i }).click();
     await waitForProcessing(page);
 
     const downloadBtn = page.getByRole("link", { name: /download/i }).first();

tests/e2e/helpers.ts

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import zlib from "node:zlib";
 import { test as base, expect, type Page } from "@playwright/test";
 
 // ---------------------------------------------------------------------------
@@ -27,6 +28,9 @@ export function getTestImagePath(): string {
 
   _testImagePath = path.join(dir, "test-image.png");
 
+  // Re-use an existing file (e.g. pre-created before the test run)
+  if (fs.existsSync(_testImagePath)) return _testImagePath;
+
   try {
     const script = [
       "const sharp = require('sharp');",
@@ -35,14 +39,56 @@ export function getTestImagePath(): string {
     execFileSync("node", ["-e", script], {
       cwd: process.cwd(),
       timeout: 5000,
+      stdio: ["pipe", "pipe", "pipe"],
     });
   } catch {
-    // Fallback: write a minimal 1x1 PNG manually
+    // Fallback: build a valid 100x100 RGBA PNG without sharp
-    const minimalPng = Buffer.from(
+    // zlib imported at top of file
-      "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwADhQGAWjR9awAAAABJRU5ErkJggg==",
+    const width = 100;
-      "base64",
+    const height = 100;
+    const raw = Buffer.alloc((1 + width * 4) * height);
+    for (let y = 0; y < height; y++) {
+      const off = y * (1 + width * 4);
+      raw[off] = 0; // filter: none
+      for (let x = 0; x < width; x++) {
+        const px = off + 1 + x * 4;
+        raw[px] = 255; // R
+        raw[px + 3] = 255; // A
+      }
+    }
+    const deflated = zlib.deflateSync(raw);
+
+    const crc32 = (buf: Buffer) => {
+      let c = 0xffffffff;
+      const t = new Int32Array(256);
+      for (let i = 0; i < 256; i++) {
+        let v = i;
+        for (let j = 0; j < 8; j++) v = v & 1 ? 0xedb88320 ^ (v >>> 1) : v >>> 1;
+        t[i] = v;
+      }
+      for (let i = 0; i < buf.length; i++) c = t[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+      return (c ^ 0xffffffff) >>> 0;
+    };
+
+    const chunk = (type: string, data: Buffer) => {
+      const tb = Buffer.from(type);
+      const len = Buffer.alloc(4);
+      len.writeUInt32BE(data.length);
+      const crcBuf = Buffer.alloc(4);
+      crcBuf.writeUInt32BE(crc32(Buffer.concat([tb, data])));
+      return Buffer.concat([len, tb, data, crcBuf]);
+    };
+
+    const sig = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+    const ihdr = Buffer.alloc(13);
+    ihdr.writeUInt32BE(width, 0);
+    ihdr.writeUInt32BE(height, 4);
+    ihdr[8] = 8; // bit depth
+    ihdr[9] = 6; // RGBA
+    fs.writeFileSync(
+      _testImagePath,
+      Buffer.concat([sig, chunk("IHDR", ihdr), chunk("IDAT", deflated), chunk("IEND", Buffer.alloc(0))]),
     );
-    fs.writeFileSync(_testImagePath, minimalPng);
   }
 
   return _testImagePath;

tests/e2e/navigation.spec.ts

@@ -40,10 +40,10 @@ test.describe("Navigation", () => {
     await expect(page.getByText("Optimization")).toBeVisible();
     await expect(page.getByText("Adjustments")).toBeVisible();
 
-    // Should show tools
+    // Should show tools (use heading-level locators to avoid matching descriptions)
-    await expect(page.getByText("Resize")).toBeVisible();
+    await expect(page.getByRole("link", { name: /^Resize/ }).first()).toBeVisible();
-    await expect(page.getByText("Compress")).toBeVisible();
+    await expect(page.getByRole("link", { name: /^Compress/ }).first()).toBeVisible();
-    await expect(page.getByText("Convert")).toBeVisible();
+    await expect(page.getByRole("link", { name: /^Convert/ }).first()).toBeVisible();
   });
 
   test("fullscreen grid has search functionality", async ({ loggedInPage: page }) => {
@@ -54,7 +54,7 @@ test.describe("Navigation", () => {
 
     // Search for a specific tool
     await searchInput.fill("resize");
-    await expect(page.getByText("Resize")).toBeVisible();
+    await expect(page.getByRole("link", { name: /^Resize/ }).first()).toBeVisible();
   });
 
   test("clicking a tool in fullscreen grid navigates to tool page", async ({

tests/e2e/rbac.spec.ts

@@ -1,7 +1,7 @@
 import { test as base, expect } from "@playwright/test";
 import { login } from "./helpers";
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 const TEST_USER = "rbactest";
 const TEST_PASSWORD = "RbacTest1";

tests/e2e/tools-all.spec.ts

@@ -11,7 +11,7 @@ const TOOLS_WITH_DROPZONE = [
   { id: "rotate", name: "Rotate" },
   { id: "convert", name: "Convert" },
   { id: "compress", name: "Compress" },
-  { id: "strip-metadata", name: "Strip Metadata" },
+  { id: "strip-metadata", name: "Remove Metadata" },
   { id: "edit-metadata", name: "Edit Metadata" },
   { id: "bulk-rename", name: "Bulk Rename" },
   { id: "image-to-pdf", name: "Image to PDF" },
@@ -33,7 +33,7 @@ const TOOLS_WITH_DROPZONE = [
   { id: "find-duplicates", name: "Find Duplicates" },
   { id: "color-palette", name: "Color Palette" },
   { id: "barcode-read", name: "Barcode" },
-  { id: "collage", name: "Collage" },
+  { id: "collage", name: "Collage", customDropzone: true },
   { id: "stitch", name: "Stitch" },
   { id: "split", name: "Image Splitting" },
   { id: "border", name: "Border" },
@@ -53,14 +53,20 @@ test.describe("All tool pages render", () => {
       // Tool name should be visible
       await expect(page.getByText(tool.name, { exact: false }).first()).toBeVisible();
 
-      // Should show dropzone
+      // Should show dropzone (some tools like collage use custom upload text)
-      await expect(page.getByText("Upload from computer")).toBeVisible();
+      const uploadText = (tool as any).customDropzone
+        ? page.getByText(/upload/i).first()
+        : page.getByText("Upload from computer");
+      await expect(uploadText).toBeVisible();
 
+      // Collage has a custom layout (no Files/Settings headings)
+      if (!(tool as any).customDropzone) {
         // Should show Files section
         await expect(page.getByText("Files").first()).toBeVisible();
 
         // Should show Settings section
         await expect(page.getByText("Settings").first()).toBeVisible();
+      }
     });
   }
 

tests/e2e/tools-process.spec.ts

@@ -125,7 +125,7 @@ test.describe("Tool processing (core tools)", () => {
     await uploadTestImage(page);
     // Wait for analysis to complete (badges appear)
     await expect(
-      page.locator("text=Intensity").or(page.locator("text=Enhancement Mode")),
+      page.locator("text=Intensity").or(page.locator("text=Enhancement Mode")).first(),
     ).toBeVisible({ timeout: 10_000 });
     // Click Enhance button
     await page.getByRole("button", { name: /^enhance$/i }).click();